PERSONAL DATA PROCESSING
pursuant to Arts. 13 and 14 of EU Regulation 2016/679 (GDPR)
Website: www.colorsoftuscany.com – Rev. 0 of 27/03/2026
Data Subjects: Website Users
Dear Data Subject,
the Data Controller hereby informs you, pursuant to Arts. 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter “GDPR”), about the processing of personal data carried out through the website www.colorsoftuscany.com (hereinafter “Site”).
1. IDENTITY AND CONTACT DETAILS OF THE DATA CONTROLLER
The Data Controller is Claudia Cesari (hereinafter also “Controller”), with registered address at Via Biccelli n. 44F, 55012 – Capannori (LU), Tax Code CSRCLD69P51E715D, VAT No. IT02525350464, contactable, in addition to the address above, at the following addresses:
– E-mail: colorsoftuscany@gmail.com
– Phone/WhatsApp: +39 352 0042652
2. CATEGORIES OF PERSONAL DATA PROCESSED
When browsing the Site, the Data Controller will process personal data which may consist of an identifier such as a name, identification number, online identifier, or one or more elements characteristic of the physical, economic, cultural or social identity of the data subject, capable of rendering that person identified or identifiable. In particular, the following categories of data are processed: browsing data, technical cookie data, and data voluntarily provided by the user, as specified below.
a. Browsing Data
The computer systems and software procedures used to operate the Site automatically acquire, in the course of their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified individuals, but by its very nature could, through processing and association with data held by third parties, allow users to be identified.
This category includes: IP addresses or domain names of computers used by users connecting to the Site, URI (Uniform Resource Identifier) notation addresses of requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (success, error, etc.) and other parameters relating to the user’s operating system and computing environment.
These data are used solely to obtain anonymous statistical information on the use of the Site, to verify its correct functioning, and to identify anomalies and/or abuse. They are deleted immediately after processing. The data may be used to ascertain liability in the event of hypothetical computer crimes against the Site or third parties.
The legal basis for such processing is the legitimate interest of the Data Controller in the technical management of the Site’s functionality and security (Art. 6(1)(f) GDPR).
b. Cookies
Cookies are strings of text placed and stored on the user’s device by websites visited by the user (so-called Publishers or “first parties”) or by different websites or web servers (so-called “third parties”), to be retransmitted to those same sites on the next visit. For further information on cookies, the User is invited to visit the dedicated page of the Italian Data Protection Authority (Garante): https://www.garanteprivacy.it/temi/cookie.
The Site uses exclusively technical cookies, which are strictly necessary for the operation of the Site and the provision of the service requested by the user. Such cookies do not require the data subject’s consent pursuant to Art. 122 of Legislative Decree 196/2003 (Italian Privacy Code) and the Guidelines of the Italian Data Protection Authority on cookies (provision of 10 June 2021).
The Site does not use profiling cookies, third-party analytics cookies, or marketing cookies or any other cookies requiring consent through a cookie banner. Therefore, the Site does not have a cookie banner.
The legal basis for processing through technical cookies is the legitimate interest of the Data Controller in the correct functioning of the Site (Art. 6(1)(f) GDPR).
c. Data Voluntarily Provided by the Data Subject
Specifically, the Site provides the following methods of interaction:
1. Sending an e-mail to the addresses indicated on the Site
The optional, explicit and voluntary sending of electronic mail to the addresses indicated on the Site entails the subsequent acquisition of the sender’s address, necessary to respond to requests, as well as any other personal data included in the communication. Such data will be processed exclusively to respond to the user’s request.
The legal basis for the processing is the performance of pre-contractual measures taken at the request of the data subject (Art. 6(1)(b) GDPR).
2. Completing the contact form on the Site
The Site allows data subjects to request information or to contact the Data Controller by entering certain personal data (such as name, e-mail address and any additional data voluntarily provided in the message field). Such data will be processed exclusively to respond to the user’s request.
The legal basis for the processing is the performance of pre-contractual measures taken at the request of the data subject (Art. 6(1)(b) GDPR).
3. Contact via WhatsApp
The Site allows the user to start a conversation with the Data Controller through the messaging service WhatsApp, provided by Meta Platforms Ireland Limited. By clicking on the WhatsApp link or button on the Site, the user is redirected to the WhatsApp application, through which they can contact the Data Controller directly. In this context, personal data of the user may be processed (such as name, phone number and the content of messages exchanged), as necessary to respond to the request.
Please note that WhatsApp/Meta acts as an independent data controller with regard to data processed within its own platform. For information on how Meta processes data, please refer to the WhatsApp Privacy Policy available at: https://www.whatsapp.com/legal/privacy-policy.
The legal basis for the processing is the performance of pre-contractual measures taken at the request of the data subject (Art. 6(1)(b) GDPR). Provision of data via WhatsApp is optional; users who do not wish to use this channel may contact the Data Controller by e-mail or through the contact form on the Site.
3. DEFINITION OF PROCESSING
Pursuant to Art. 4(2) GDPR, “processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
4. PURPOSES OF PROCESSING, LEGAL BASIS AND MANDATORY OR OPTIONAL NATURE OF DATA PROVISION
The processing of data that the Data Controller intends to carry out may have the following purposes:
a) Provision of the services requested by the User, such as responding to general or specific information requests through the Site. The legal basis is Art. 6(1)(b) GDPR (performance of a contract to which the data subject is party, or execution of pre-contractual measures taken at the request of the data subject). Provision of data for these purposes is optional, but failure to do so would make it impossible for the Site to provide its services.
b) Compliance with legal obligations. This purpose constitutes processing of personal data carried out pursuant to Art. 6(1)(c) GDPR, for compliance with a legal obligation. Once personal data have been provided, processing is necessary to comply with a legal obligation to which the Data Controller is subject.
c) Establishment, exercise or defence of legal claims, in the event of abuse in the use of the Site and/or the services offered. Such processing would be carried out pursuant to Art. 6(1)(f) GDPR (legitimate interest of the Data Controller).
5. METHODS OF PROCESSING
Data processing may be carried out by electronic, telematic or automated means, in compliance with the technical and organisational security measures referred to in Art. 32 GDPR, by persons authorised to process data and duly instructed and trained, pursuant to Art. 29 of the above-mentioned Regulation.
6. RETENTION PERIOD
Personal data processed for the purposes referred to in section 4, letters a) to c), will be retained for the time strictly necessary to achieve those same purposes, in compliance with the principles of data minimisation and storage limitation set out in Art. 5(1)(e) GDPR.
In particular, data collected via the contact form and e-mail will be retained for the time necessary to manage the relationship established with the user and, thereafter, for the period required by applicable statutory limitation provisions.
7. RECIPIENTS OF PERSONAL DATA
Personal data may be shared, for the purposes described in section 4, with:
a) Parties typically acting as data processors pursuant to Art. 28 GDPR, namely:
· individuals, companies or professional firms providing assistance and advisory services to the Data Controller in connection with the services offered through the Site;
· the Site’s hosting service provider (Aruba S.p.A., registered office at Via Sergio Ramelli 8, Ponte San Pietro (BG), Italy), acting as data processor pursuant to Art. 28 GDPR; the servers are located in Italy;
· parties responsible for technical maintenance activities (e.g. maintenance of network equipment and electronic communications networks);
· Meta Platforms Ireland Limited (provider of the WhatsApp service), registered office at 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, acting as an independent data controller for data processed within its own platform. Please refer to the WhatsApp Privacy Policy for the relevant information on processing.
The list of data processors may be requested from the Data Controller.
b) Subjects, entities or authorities acting as independent data controllers, to whom it is mandatory to disclose personal data pursuant to applicable laws or orders issued by competent authorities.
8. DATA DISCLOSURE
Unless specifically requested in writing by the data subject, or required by specific legal provisions or orders of the Data Protection Authority/regulatory authority, the personal data provided will not be subject to dissemination.
9. TRANSFER OF DATA OUTSIDE THE EEA
The Site’s servers are located in Italy (provider: Aruba S.p.A.) and browsing data, technical cookies and data collected via the contact form and e-mail are not transferred outside the European Economic Area (EEA).
With regard to the WhatsApp channel, the service is provided by Meta Platforms Ireland Limited (Ireland, EEA) and Meta Platforms, Inc. (USA). In connection with the use of WhatsApp, personal data of the user may be transferred to and processed on servers located in the United States or other third countries outside the EEA. Such transfers take place in compliance with applicable law, on the basis of the safeguards provided for by the GDPR, including the Standard Contractual Clauses approved by the European Commission (Art. 46(2)(c) GDPR) and, with regard to transfers to the USA, the EU-US Data Privacy Framework adequacy arrangement (European Commission adequacy decision of 10 July 2023), to which Meta has adhered. For further information, please refer to the WhatsApp Privacy Policy: https://www.whatsapp.com/legal/privacy-policy.
10. RIGHTS OF THE DATA SUBJECT
Applicable law grants the data subject the exercise of specific rights under Arts. 15 to 22 GDPR. In particular, the data subject has the right to:
· Access (Art. 15 GDPR): obtain from the Data Controller confirmation as to whether or not personal data concerning them are being processed and, if so, to obtain access to the personal data and related processing information;
· Rectification (Art. 16 GDPR): obtain the rectification of inaccurate personal data concerning them and/or the completion of incomplete personal data;
· Erasure (Art. 17 GDPR): obtain the erasure of personal data concerning them, where one of the conditions provided for by the regulation applies;
· Restriction of processing (Art. 18 GDPR): obtain restriction of processing in the cases provided for by the regulation;
· Data portability (Art. 20 GDPR): receive the personal data concerning them provided to the Data Controller in a structured, commonly used and machine-readable format, and to transmit those data to another controller, where the processing is based on consent or a contract and carried out by automated means;
· Objection (Art. 21 GDPR): object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them where the processing is based on the legitimate interest of the Data Controller;
· Withdrawal of consent: where the processing is based on the data subject’s consent, to withdraw consent at any time, without prejudice to the lawfulness of processing based on consent given before its withdrawal.
Requests relating to the exercise of these rights may be addressed to the Data Controller at the contact details indicated in section 1, without any particular formalities, or alternatively by using the form made available by the Italian Data Protection Authority (Garante), available at: http://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/1089924.
11. RIGHT TO LODGE A COMPLAINT WITH THE SUPERVISORY AUTHORITY
The data subject has the right to lodge a complaint with the competent supervisory authority. In Italy, the supervisory authority is the Garante per la Protezione dei Dati Personali, contactable in accordance with the procedures and within the time limits indicated on the website www.garanteprivacy.it.
12. INFORMATION PURSUANT TO ART. 14 GDPR – DATA NOT COLLECTED DIRECTLY FROM THE DATA SUBJECT
The Data Controller informs that, with regard solely to browsing data (see section 2, letter a), personal data are not collected directly from the data subject but are automatically acquired by the Site’s computer system during normal user browsing, as described in point 2, letter a). Such data are processed exclusively for the technical and security purposes indicated, in compliance with the principle of data minimisation, and are not retained beyond the time strictly necessary.
13. CHANGES TO THIS NOTICE
The Data Controller reserves the right to modify or simply update the content of this notice, in whole or in part, also following the activation of new services or updates to applicable legislation. The Data Controller will give notice of such changes as soon as they are introduced and they will be binding as soon as published on the Site. You are therefore invited to visit this section regularly to be informed of the most recent and up-to-date version of the privacy notice.
This notice relates exclusively to the website www.colorsoftuscany.com and not to any other websites that may be reached via links on the Site, for which reference is made to the specific notices contained therein.
Privacy notice drafted pursuant to Arts. 13 and 14 of Regulation (EU) 2016/679 (GDPR) – Rev. 0 of 27/03/2026